Since Microsoft started promoting the free upgrade to Windows 10, changes have occurred in Windows Update. I'm a true believer in not installing anything that I don't know that my system needs. This means that I have installed very few optional updates, only the "Platform Update for Windows 7" and other optional updates required to install Internet Explorer 11. This means that no updates pertaining to the "free Windows 10 upgrade" or the Windows Update Cient itself have been installed.

As a side note, the updates to the Windows Update Cient are among the "critical/important" updates but they remove the Windows Update Icon from the Notification Area. Don't ask me why the Icon is removed but I like the Icon to be there so, I omit those updates too.

I download the updates manually to the computer and install them off-line. Before installing the new batch of updates, I restore the Ghost Image from previous month and afterwards, I create a fresh Ghost Image. This means that the Windows Update Client is the same as when installed in 2011. There's no problem installing a batch of updates with a single reboot when done.

However, during the month, when Windows Update checks for updates, strange things happen.

My system has an AMD Phenom II, quadcore 3 GHz and 4 GB RAM.

When the computer is started and Windows Update checks for updates, there's a process "TrustedInstaller" and an instance of svchost.exe that combined use 25% of the CPU and several GB of RAM. Total RAM usage is up to 75%. It goes on for some 25 minutes and when done, CPU usage drops to "idling" and RAM usage to 17-18%.

If I try to manually install updates when this "process" is running in the background (not initiated by yours truly), I get to the first one but the second hangs until the "process" has been terminated. Well, I can terminate the "wsus process" and restart the computer between each update but what the heck ... :-X ... ?

Prior to "Windows 10 promotion", a run of Windows Update took approximately a minute or a few at most.

On a second startup, when Windows Update doesn't check for updates, the computer settles at 25% RAM usage with no excessive CPU usage.

Is there anyone out there with the same experience?

Any thoughts?

@ Christer

Windows Update has become a total disaster!!!  I thought it was for getting security updates--but now we are getting Potentially Unwanted Programs (PUP) which are forcing us to download and install other programs (Win10) that we may not want!!!!

I'm not having your exact problem--so can not help with direct experience--but, I have seen posts elsewhere that sound similar--and maybe a solution is hiding in the discussion.

Are you familiar with *Ask Woody*?  Here's a link:  http://www.askwoody.com/

It's a blog--not a forum--and people can comment after different blog postings by Woody are made--so information tends to be fragmented and scattered all over the place.

But, this posting and it's comments may have some information for you:  http://www.askwoody.com/2015/msdefcon-2-patch-tuesday-coming/

So, commenter Marty on 9/7 says his Windows Update icon indicating *when there are new updates* has disappeared.  Ed on 9/9 says he too has that problem, and speculates as to why:


Quote:

I have KB2952664 and KB3035583 hidden and I also have the Scheduled Task for “Microsoft Compatibility Appraiser” disabled under Application Experience. Those have all been in that status for several months.

Marty, on 9/9 states:


Quote:

The WU icon is now missing in the notifications area on all 5 of my Win7 machines (both 32- and 64-bit). This happened only after I installed the August 11 updates. My speculation is that KB 3075851 (Windows Update Client) was the cause of this, but I haven’t tried uninstalling that update in order to confirm that.

Ed posts on 9/14:


Quote:

I don’t know if this has any significance or not but as I stated above along with having the two updates hidden on every Win 7 system I maintain I also have a scheduled task disabled that others are not mentioning. Whether that scheduled task has any correlation to downloading the files or not is unknown but I can testify without a doubt with task enabled it causes a significant strain on systems upon every boot-up OR at 3 AM every day if the system is powered on (whether a user is logged in or not).

That sounds like your complaint!!!  Do you have that scheduled task in the Task Scheduler?


On 9/14 Marty reports:


Quote:

As an experiment, I tried uninstalling KB3075851 from one of my Win7 computers. The WU icon is now back in the Notification Area. But the price I paid for that was wiping out WU’s list under “View update history”.

On 9/16, a new poster, jelson, makes these comments:


Quote:

@Marty My experience mirrors yours. Uninstalling KB3075851 restored the WU notification and cleared update history. However, WU then took a long, long time to check for updates and download them. That made doing updates a pain since I install them in sets instead of all at the same time I found the solution to be uninstalling all the recent WU Client update patches: KB3050265, KB3065987 and KB2990214 Now WU is functioning the same it used to.

On 9/18, Ed made these comments:


Quote:

“I found the solution to be uninstalling all the recent WU Client update patches: KB3050265, KB3065987 and KB2990214″ I’m also experiencing drastically long checks for updates and I’m tempted to follow suit here myself but I’m a bit hesitant. I’m wondering if there may be a residual effect that may outweigh the benefit? What say you Woody? Do these 3 WU Client updates only benefit MS or do they contain anything “useful” for the user?

Woody responded:


Quote:

@Ed - I’m running experiments even as we speak. It’s NOT a simple situation.

Unfortunately, Woody has never followed up or responded regarding these issues.

On 10/13, Ed responded:


Quote:

Since nothing ever appeared here after my last “nag” I never did uninstall any of the 3 WU client updates… but for some unknown reason at 4:35 AM today a little bubble popped up from my tray telling me there were updates available. Other than disabling the Diagnostic Tracking service and running the GWX control panel I did nothing, could that possibly have some relationship to the notification icon reappearing?

If any of the above has any relevance to your problems--let us know what you find out!!!  Presumably making an image and testing any of the suggestions would tell you if they help--you can always restore the image and be back where you started.

I know you said that you have not installed any of the WU Client updates--have you checked the WU updates KB's mentioned above against your install history?

And, I'd be interested in knowing if you have that scheduled task running!!!


Christer wrote on Oct 16^th, 2015 at 6:04am:

Before installing the new batch of updates, I restore the Ghost Image from previous month and afterwards, I create a fresh Ghost Image. This means that the Windows Update Client is the same as when installed in 2011.

I have to admit, I'm not exactly sure what you are saying here--could you elaborate?

@ NightOwl


Quote:

Are you familiar with *Ask Woody*?

I don't recall ever visiting Woody but I may have forgotten about it. I'll follow the link later. For now, I'll respond to your quotes.


Quote:

I have KB2952664 and KB3035583 hidden and I also have the Scheduled Task for “Microsoft Compatibility Appraiser” disabled under Application Experience. Those have all been in that status for several months.

Those two updates pertain to the "free Windows 10 promotion" and are optional which means that I don't have them installed. I have tested them and with the latter, a new Icon in the Notification Area appears - a blue/white Windows Flag nagging about Windows 10. The updates were removed by restoring an Image.


Quote:

My speculation is that KB 3075851 (Windows Update Client) was the cause of this, but I haven’t tried uninstalling that update in order to confirm that.

That's my conclusion too. It started in August with KB3075851 which in September was replaced by KB3083324 and in October by KB3083710. They seem to be monthly revisions of the same disaster, sorry ... :-/ ... update, which means that we have not seen the last one. I have tried them all with the same result (loss of the WU-icon in the Notification Area). They were all uninstalled by restoring an Image.


NightOwl wrote on Oct 17^th, 2015 at 12:52am:

That sounds like your complaint!!!Do you have that scheduled task in the Task Scheduler?

No, if referring to "Microsoft Compatibility Appraiser under Application Experience", I don't have it. I believe that task is linked to KB2952664 (which checks the system for Windows 10 compatibility) and possibly KB3035583.

On my system, after restoring an Image, without any of the mentioned updates installed, the process "TrustedInstaller" and an instance of svchost.exe appear as soon as the computer has been connected to the internet and WU has been run. The problem problem seems to be dumped on me in the background.


Quote:

As an experiment, I tried uninstalling KB3075851 from one of my Win7 computers. The WU icon is now back in the Notification Area. But the price I paid for that was wiping out WU’s list under “View update history”.

Since I don't uninstall but restore an Image, the update history is unaffected.


Quote:

I found the solution to be uninstalling all the recent WU Client update patches: KB3050265, KB3065987 and KB2990214

Those pre-August updates were "optional". I didn't notice the "WU Client updates" until KB3075851 was made "important" from August. As I mentioned, I never install or even look at all the "optional" updates.


Quote:

What say you Woody? Do these 3 WU Client updates only benefit MS or do they contain anything “useful” for the user?

I ask the same question and my own answer is ... ::) ... MS-spyware.


Quote:

Since nothing ever appeared here after my last “nag” I never did uninstall any of the 3 WU client updates… but for some unknown reason at 4:35 AM today a little bubble popped up from my tray telling me there were updates available.

That's interesting! It was on the same day that the October batch of updates was released. I wonder if it was while KB3083324 was still the most recent (prior to installing the new batch) or if the October version, KB3083710, had been installed?

I should always have the Icon showing because in Control Panel > Notification Area Icons, the check box to "Always show all icons and notifications on the taskbar" has been checked since "day one".


Quote:

Other than disabling the Diagnostic Tracking service and running the GWX control panel I did nothing, could that possibly have some relationship to the notification icon reappearing?

I don't have the Diagnostic Tracking Service.

I think that GWX is the "Get Windows 10" task/service which is installed by KB3035583. It can be disabled by a regedit.


NightOwl wrote on Oct 17^th, 2015 at 12:52am:

If any of the above has any relevance to your problems--let us know what you find out!!!Presumably making an image and testing any of the suggestions would tell you if they help--you can always restore the image and be back where you started.

I believe I have covered it all above but if I have missed something, please ask again.


NightOwl wrote on Oct 17^th, 2015 at 12:52am:

I know you said that you have not installed any of the WU Client updates--have you checked the WU updates KB's mentioned above against your install history?

They are not in my update history. They have, from August been installed, one after the other when released but always "removed" by restoring an Image.


NightOwl wrote on Oct 17^th, 2015 at 12:52am:

And, I'd be interested in knowing if you have that scheduled task running!!!

Nope, never heard of it. I only have "TrustedInstaller + an instance of svchost.exe that I have identified as
culprits. When the RAM-usage drops to normal, TrustedInstaller goes away from the Taskmanager but I haven't counted the number of instances of svchost.exe.

@ NightOwl

I ran out of characters so here comes the final comments:


NightOwl wrote on Oct 17^th, 2015 at 12:52am:

I have to admit, I'm not exactly sure what you are saying here--could you elaborate?

Well, reading it I hardly understand myself ... ;D ... !

Since installing the system, I have created a monthly Image. The Images are "virgin" in the meaning that the computer has never been connected to the internet. It is clean, apart from one single connection to activate Windows 7.

To maintain virginity (of the computer), my routine is:

After a months usage, when the new batch of Windows Update Grenades ... ;) ... are released, I check the updates and download those that I plan to install. After downloading, I disconnect from the internet.

Next, I restore the Image from the previous month.

Next, I install the selected updates from the downloaded files.

Finally, after cleaning up tempfiles and such, followed by a defragmentation, I create a new Image.

A wee bit cumbersome but I know that at least one in my household is a Virgin ... :-/ ... !

@ NightOwl


Christer wrote on Oct 16^th, 2015 at 6:04am:

This means that the Windows Update Client is the same as when installed in 2011.

Well, on a second or third thought, it probably isn't. Since the computer is a Virgin, Windows Update is of the version that searches for updates to Windows only. After the cumbersome procedure described above, the first step I take is to install Microsoft Security Essentials and with that, Windows Update is upgraded to search for updates to "Windows and other products" (or whatever it says in English).

The plot thickens ... :o ... and when I find the time, I'll restore an Image and let the computer connect to the internet to run Windows Update without MSE.

@ NightOwl


Christer wrote on Oct 17^th, 2015 at 8:10am:

When the RAM-usage drops to normal, TrustedInstaller goes away from the Taskmanager but I haven't counted the number of instances of svchost.exe.

Now I have counted them. While Windows Update does its thing, there are 14 instances of svchost.exe + a single svchost.exe *32. When done and TrustedInstaller goes away, the count drops to 13 + 1.

@ NightOwl

I've been at Woody's and read the entry on the October updates (MS-DEFCON 2: Time to get Windows Update locked down again). A comment made by Ed indicates that installing one of these udates to the Windows Update Client, cures the resource hogging and lenghty search for updates but at the expence of the Icon in the Notification Area. I'll check it out!

EDITED:

I initiated a run of Windows Update. It took ~8 minutes, used 25% CPU and total RAM-usage was 72%.

I installed KB3083710 and restarted the computer.

After the usual few minutes of waiting, the WU-Icon appeared in the Notification Area.

I initiated a run of Windows Update. It took ~17 minutes, used 25% CPU and total RAM-usage was 46%. This was the first run with the updated Client. I restarted the computer.

After the usual few minutes of waiting, as expected, the WU-Icon did NOT appear in the Notification Area.

I initiated a run of Windows Update. It took ~8 minutes, used 25% CPU and total RAM-usage was 44%.

On my system, it seems like a choice of "plague or cholera". Less RAM-usage but loss of the Icon in the Notification Area.

The jury is still out. It will be 24 hours after the latest run of WU until it runs automatically upon starting the computer. Prior to installing KB3083710, this has taken ~25 minutes. I'll find out tomorrow if there's an improvement.

@ NightOwl


Christer wrote on Oct 19^th, 2015 at 1:12pm:

The jury is still out. It will be 24 hours after the latest run of WU until it runs automatically upon starting the computer. Prior to installing KB3083710, this has taken ~25 minutes. I'll find out tomorrow if there's an improvement.

Well, there's an improvement. It took 10 minutes using the same 25% CPU but RAM-usage (total) has been reduced to 45%. The question is why the Icon goes away from the Notification Area? Annoying but maybe I can learn to live without it. Less convenient ... :-X ... to launch Windows Update from the Programs Menu or the Control Panel!

"Other than disabling the Diagnostic Tracking service and running the GWX control panel ..."

"I think that GWX is the "Get Windows 10" task/service which is installed by KB3035583"

For the benefit of lurkers, let's clarify that GWX and GWX Control Panel are two different things. GWX is Microsoft's "Get Windows 10" update, which MS tries to sneak in with other Windows updates into your 7 or 8.1 system. GWX Control Panel is a no-install, third-party utility to check and prevent MS from sneaking GWX into your system. GWX Control Panel is a vital tool to make sure your system is not being upgraded to Win 10 behind your back.

I agree with NightOwl that Windows Update has become a disaster. For me it reached that point a few years ago, before the current GWX debacle. For about 3 years now, I've been turning Windows Update completely OFF on all the systems I support. I gave up on the "Let me choose" option when MS started sneaking certain updates by and auto-installing despite the "Let me choose" setting. Turning updates completely off seems to have prevented that kind of problem, though I'm not entirely confident MS can't still slip something through if it wants.

In lieu of online updating, I've been instead using WSUS Offline Update. (I'll describe this utility in a separate post for those who wish to know more.) One key feature of WSUS Offline is the ability to blacklist updates you don't ever want installed. So rather than playing cat-and-mouse games with Windows Update, I just blacklist them in WSUS Offline and they never get installed.

Some may argue that my delayed-install strategy doesn't get legitimate updates installed in a timely manner, but for me that's an acceptable tradeoff. Historically, my pristine system has proven to be at greater risk from Microsoft than from random hackers on the internet. Given the number of bad updates MS has pushed out in recent years, I prefer to let others be the guinea pigs before I install an update on my system.

(Okay, full disclosure time: I even quit using AV on my own system over a year ago. After hearing that experts like Steve Gibson and Bruce Schneier don't use AV on their personal systems, I gave it some thought and realized that my system has never been infected and it's been years since I've even heard a peep from any of my AV programs. I don't recommend this for everyone, but for those of us who are overly cautious the risk of malware infection seems so low that we can get away relying only on backup images if anything bad happens. It took me a year before having the guts to finally pull the plug, but I did a little over a year ago, and have had absolutely no problems.)



I like Christer's Reply #3. That's the same strategy I've been using since before the release of XP-SP3 8 years ago, although I reimage annually instead of monthly. My philosophy is that because Microsoft constantly issues patches and then patches to those patches, I prefer to wait more than one month for MS to get it right before I install anything and in the long run I should end up with a cleaner system.

Like Christer, my strategy is to make a clean install, include programs I know I'll always want to keep, then store away an image. Throughout the subsequent year I may add updates and additional programs, but may decide some of those new programs aren't worth embedding in my pristine image.

At the end of the year I make a note of which programs are keepers, then restore the year-old image, update Windows, add back in the new programs I decided to keep, and reimage. Similar to Christer, my pristine image never actually touches the internet. Windows updates are applied via WSUS Offline.

Once a system is compromised, you can never be 100% certain you'll get every bit of the malware cleaned out. But by using Christer's and my strategy, we can have a high degree of confidence that--at least once a year (or month, in Christer's case)--our systems are completely free of viruses, malware and backdoors after this kind of "scorched earth" restore.

I've been using CT Update and its successor, WSUS Offline Update, for around 10 years to (relatively) quickly bring a clean install up to date, or for updating customers' computers onsite when they have a bad or slow internet connection. In recent years, though, I've taken to also using it on all computers in lieu of online updating entirely.

The principle behind WSUS Offline Update is that you keep copies of all Windows updates ("Important" updates only, not the "Optional" ones) on an external USB drive or flash drive, then use that to update other machines when desired. I have updates for all consumer versions of Windows 2000 through 8.1, plus Office versions from 2000-2013. I've long used a USB hard drive, but economical flash drives are now large enough that a 32GB or 64GB flash drive will easily hold the entire cache.


Installing WSUS Offline Update

Start by downloading the WSUS Offline Update utility from here. Support for 32-bit XP seems to have been dropped in v9.3, so download v9.2.1 or earlier from the WSUS download page if you want to include updates for 2000, XP, or Office 2000-2003. (Note: because it's a no-install program, there's no reason you can't keep two versions on your external drive--one for older OS's and one for new.)

Drag the "wsusoffline" folder out of the zipfile and copy it to external USB drive. This is a no-install program, so just drag it to a convenient place and run it from there.

From any working Windows machine, launch the folder's updategenerator.exe file. Tick the OS and Office versions for which you want updates. If using v9.2.1, tick XP and/or Office 2003 on the [Legacy products] tab.

Click [Start] to download all updates to the external drive. The first time you do this, it will take quite some time to download everything, so the faster your internet connection, the better.

(Aside: some AV programs can slow downloads to a crawl--one windows cabinet file, wsusscn2.cab, in particular. For best results, temporarily disable AV while updategenerator is downloading.)

After downloading is finished attach the external drive to a machine you want to update, and launch the wsusoffline\client\updateinstaller.exe file to start the update process. It will still take time to install the updates, but at least you won't be sitting around waiting for it to also download every update before installing.

I run updategenerator.exe every 3-4 months to keep it moderately up to date. I usually do that at the end of the month, on the theory that if the most recent "Second Tuesday" updates had a particularly bad update there's more chance the update would have been pulled before I update my WSUS Offline cache.


Blacklisting Updates

Add any updates you want to the wsusoffline\client\exclude\ExcludeList.txt text file. (I assume that since this file is under the client folder, blacklisted updates will still get downloaded but just won't get installed.)

Attached is my ExcludeList.txt file. Note that all the problematic updates mentioned in earlier posts in this thread are on the blacklist.

Note that I have service packs and IE versions in my blacklist. That's not because they're bad, it's because I don't want WSUS Offline automatically installing them. I may want different service packs on different installations, so I leave WSUS Offline out of it and install service packs manually in the cases where I want them.

---

@ Dan Goodell


Quote:

I like Christer's Reply #3. That's the same strategy I've been using since before the release of XP-SP3 8 years ago, although I reimage annually instead of monthly.

It takes a few hours to go through the "cumbersome procedure" and I have considered doing it less often, maybe quarterly or biannually but you do it annually ... :-/ ... which indicates that I am overdoing it.

My Ghost-HDD is partitioned in 4, 2 for W7 and 2 for XP (dualboot). When one partition (for each OS) gets full, I reformat the other (holding older Images) and use it as the target for Ghost. This means that I have some 5-10 Images to roll back. Hopefully, any and all issues have been noticed and fixed within that timeframe.

Space is, however, becoming a problem since the W7 installation has grown from 13313 MB (january 2011) to 32404 MB (october 2015). The size is according to Ghost, less the pagefile. I have not installed any programs of significant size and that 143% growth ... :-? ... is, more or less, caused by updates to Windows and Office!

(To compare, the size of the XP installation has grown from 5935 MB to 10138 MB, a 71% growth.)

I'm aware of the Disk Cleanup Wizard addon, I have tested it but didn't install it "permanently". After running it, there was a significant reduction of used space, at the time some 5 GB. Do you have that update installed and if so, do you use it?

@ Dan Goodell


Quote:

I've been using CT Update and its successor, WSUS Offline Update, for around 10 years to (relatively) quickly bring a clean install up to date, ...

Interesting, I never knew about this possibility. I'll read up on it but have a few thoughts already.


Quote:

After downloading is finished attach the external drive to a machine you want to update, and launch the wsusoffline\client\updateinstaller.exe file to start the update process. It will still take time to install the updates, but at least you won't be sitting around waiting for it to also download every update before installing.

With reference to the "Disk Cleanup Wizard addon", when you do the annual update of your computer, does it install missing updates only or are obsolete updates removed, making the addon not needed?

I compared your ExcludeList with my installed updates:

KB971033,windows activation technology, nag update > I have this one installed but have not noticed any nagging. But then, my software is legit (not implying that your software isn't).

KB2823324,Windows kernel-mode driver causes BSOD > I assume that I had this one installed but it was replaced by KB2840149 which was released "out of band". It seems like I read Microsoft Security Bulletin MS13-036 after the release of KB2840149. The reason I believe that, is that KB2823324 is not among my installed updates (in Control Panel > Programs and Features), only KB2840149. I wonder if I had noticed Microsoft's recommendation to uninstall KB2823324 prior to installing KB2840149 if it had not been released "out of band"? It can't be critical to uninstall the previous update since everyone doing it the "easy way" probably had KB2840149 installed over KB2823324, right?

KB2990214,Enables update from 7 to later version > I have this one installed and it may be the reason for my issues. I'll uninstall it and check the behaviour of WU afterwards.

KB3038314,IE11 security update prevents configuration changes > Updates to Internet Explorer are cumulative, right? Wouldn't the problem be transferred to all subsequent cumulative updates to Internet Explorer?

Regarding specific updates, I don't examine or vet each one, and don't pretend my blacklist is comprehensive. I follow a few Windows forums, and if there's a lot of chatter about a particular KB then I'll add it to my blacklist. For starters, there's a good list here concerning the ongoing GWX and telemetry fiascos.

I skip the "activation technology" updates (both Windows and Office) on principle. The activation technology built into Windows when it was shipped ought to be enough, and I'm not happy with Microsoft conjuring up new ways to sniff around my computer. If my copies of Windows or Office weren't legitimate, the original activation technology built into them would catch that, so why does the activation technology need an update? Is the update for my benefit or Microsoft's?

Furthermore, there are constant, recurring discussions online from people with legit installations suddenly being flagged as illegitimate. Since most people install every update, I wonder what role the activation updates might play in this. If an update is making the process more aggressive, perhaps it's generating false positives. My installation is legit, Windows says it's activated ... that should be end of story. What benefit for me could there possible be in any "activation technology update"?




Quote:

when you do the annual update of your computer, does it install missing updates only or are obsolete updates removed?

I'm not an expert on the Windows update process, but I don't think most updates are uninstalled when obsoleted by a subsequent update. And even when a particular .dll is updated the former version isn't deleted, it's archived so it can be reverted to if the superceding update is rolled back.

In contrast, if obsolete updates were never applied in the first place, then they're not going to get installed when you eventually get around to updating--that's whether you do it by WSUS Offline or online Windows Update. Only the latest patch will be installed. (In fact, I've watched the files in my WSUS Offline cache when I refresh WSUS and have noticed KB updaters getting *removed* when they've been obsoleted.)

For example, if throughout the year MS pushes out updates A, B, C and D, each one superceding the former, then my annual method might get only update D embedded in my pristine image. Your method might get B and D embedded. Everyone else (those who never revert to a pristine image) will get all four updates embedded.

That's the kind of bloat I'm trying to avoid by waiting longer before updating my pristine image.




Quote:

the W7 installation has grown from 13313 MB (january 2011) to 32404 MB (october 2015). [...] that 143% growth ... Huh ... is, more or less, caused by updates to Windows and Office!

The installation on the machine on which I'm writing this is 13GB, and has been updated through Jun 2015. I don't have Office on this particular machine so that would account for some of the difference, but a big portion of the difference between your installation and mine will be orphaned files and other detritus left behind by superceded updates.




Quote:

I'm aware of the Disk Cleanup Wizard addon, I have tested it but didn't install it "permanently". After running it, there was a significant reduction of used space, at the time some 5 GB. Do you have that update installed and if so, do you use it?

Yes, I have it installed, but running it makes practically no difference on my system. It has had dramatic results on some of my customers' systems, though, in some cases recovering 8 or 9 GBs.

@ Dan Goodell


Quote:

... but a big portion of the difference between your installation and mine will be orphaned files and other detritus left behind by superceded updates.

I checked my notes and Adobe Acrobat 9 with all updates was installed in january 2013. It accounts for some 3,5 GB but there's still 15 GB "uncontrolled" growth.

I have an Image, created during installation (if my fat fingers should slip) and it contains an activated Window 7, Office 2007 + SP2 and nothing else. I'm considering restoring it, add SP1 for Windows 7, SP3 for Office 2007 and Adobe Acrobat 9. Next, I'll let WSUS Offline Update loose on it.

The tail ... ::) ... has started wagging the dog!

@ NightOwl


Christer wrote on Oct 17^th, 2015 at 8:37am:

The plot thickens ... :o ... and when I find the time, I'll restore an Image and let the computer connect to the internet to run Windows Update without MSE.

I restored an Image and let WU run "as it was", checking for updates to Windows only. The first run was in terms of CPU- and RAM-usage, similar to the previous ones. However, on the second run, WU updated the Windows Update Agent to 7.6.7600.320. That's the version I get when installing MSE but still for Windows only. It made no difference concerning performance and CPU-/RAM-usage.

I restored my Image once more. I uninstalled KB2990214 (on Dan's blacklist) since it was the only update, pertaining to the Windows Update Client, that I had installed. Next, I installed MSE and connected to the internet to get the updates. When that's done, it takes a while longer for WU to complete its search. KB2990214 did'nt reappear, only KB3083710 which is the most recent update to the Windows Update Client. Again, no difference in terms of performance.

Weird, right? If there's any logic to all this, the Windows Update Agent is the prime suspect in the meaning that all this happens on the other side of my firewall.

@ Christer

Looks like my initial information has not helped your situation.


Quote:

(forgot how to get the red @) NightOwl

At least I can help with this!
The little down pointing triangle just to the left of the user's name puts that red @ and the users name into the reply box.  Just left click on the triangle.


Christer wrote on Oct 17^th, 2015 at 8:10am:

I only have "TrustedInstaller + an instance of svchost.exe that I have identified as culprits.

Here's someone who has chosen to disable *TrustedInstaller* and only re-enable it once a month to do updates:  https://www.youtube.com/watch?v=i_d2-Qz2VA0

Apparently, either making a registry change to disable the *Get Windows 10* (GWX) from updating thru Windows Update, or using the *GWX Control Panel* to *Disable Operating System Upgrades in Windows Update*  ( http://blog.ultimateoutsider.com/2015/08/using-gwx-stopper-to-permanently-remove.html ) allows for the *New Updates Available* icon returning if it has been missing.  There are multiple reports that this is solving that problem in various comments at http://www.askwoody.com/

@ NightOwl


NightOwl wrote on Oct 24^th, 2015 at 12:57am:

Looks like my initial information has not helped your situation.

Well, every little bit helps, at least it confirms my findings.


NightOwl wrote on Oct 24^th, 2015 at 12:57am:

At least I can help with this! The little down pointing triangle just to the left of the user's name puts that red @ and the users name into the reply box.Just left click on the triangle.

Thanks, I'll edit my posts!


NightOwl wrote on Oct 24^th, 2015 at 12:57am:

Here's someone who has chosen to disable *TrustedInstaller* and only re-enable it once a month to do updates:

Yes, there are ways to circumvent this and other problems but I don't understand why WU had to get messed up in the first place? Also, since you and probably others too, don't have the same issues, it seems to be "hit or miss" but what is deciding?

There are other "brainfarts" that made a mess among cumulative and non-cumulative updates for different versions of Internet Explorer. According to KB2957689, for Windows 7 and IE11, KB2929437 is a prerequisite to get future updates.


Quote:

Important note for Internet Explorer 11 systems This update applies only to computers that are running Internet Explorer 11 and that do have update 2919355 (for Windows 8.1 or Windows Server 2012 R2) or update 2929437 (for Windows 7 SP1 or Windows Server 2008 R2 SP1) installed. All future security and nonsecurity updates for Internet Explorer 11 require you to have update 2919355 or update 2929437 nstalled in order to receive updates. We recommend that you install update 2919355 or update 2929437 in order to continue to receive updates.

That was true for some time but a few weeks ago, I checked while installing a fresh system (W7), updating Internet Explorer from 8 to 11. After the installation was complete, I connected to the internet and let Windows Update loose. The system was not offered KB2929437 (the prerequisite) but only the most recent cumulative update. Obviously, the "prerequisite KB2929437" is history but I can't help wondering where all the non cumulative updates went? Into the same bin as KB2929437 or is that fresh system lacking some non cumulative updates? (Regard that question as rhetorical ... :-X ... !)

In addition to that, there were cumulative updates to IE11 but they required an additional, bundled, update to provide full protection. It seemed like a lot of dogwagging at the time ... ::) ... and probably still ...

Comparing my current WSUS Offline cache (build date: 09/30/2015) with an older, backup copy I haven't yet updated (build date: 12/31/2014), I note KB2929437 has been removed. My Dec 2014 cache listed several IE11-specific updates that are no longer in the Sep 2015 cache:

2909210
2929437
2936038
2953522
2957689
2962872
2963952
3008923

My Sep 2015 cache shows all of the above removed and one new entry: KB3087038, released in Sep 2015. I couldn't find any information online specifically saying so, but my presumption would be 3087038 has replaced the other eight updates.

@ Dan Goodell


Dan Goodell wrote on Oct 24^th, 2015 at 4:15pm:

Comparing my current WSUS Offline cache (build date: 09/30/2015) with an older, backup copy I haven't yet updated (build date: 12/31/2014), I note KB2929437 has been removed. My Dec 2014 cache listed several IE11-specific updates that are no longer in the Sep 2015 cache: 2909210 2929437 2936038 2953522 2957689 2962872 2963952 3008923 My Sep 2015 cache shows all of the above removed and one new entry: KB3087038, released in Sep 2015. I couldn't find any information online specifically saying so, but my presumption would be 3087038 has replaced the other eight updates.

Not all of those updates are among my manually downloaded cash but then, our systems differ. KB3087038 is the cumulative upate to Internet Explorer in the september batch of updates. It was replaced by KB3093983, released in october.

In Microsoft Security Bulletin MS15-106 it is remarked:


Quote:

*The Updates Replaced column shows only the latest update in any chain of superseded updates. For a comprehensive list of updates replaced, go to the Microsoft Update Catalog, search for the update KB number, and then view update details (updates replaced information is provided on the Package Details tab).

I've tried to go to Microsoft®Update Catalog but always draw a blank page.

Running WSUS, is there a way to download a list of updates that are selected without actually downloading?

Christer wrote on Oct 24^th, 2015 at 4:58pm:

I've tried to go to Microsoft®Update Catalog but always draw a blank page.

I had trouble, too. But I was able to properly view it with XP/IE7 in a virtual machine.

It seems like it ought to be a nice tool--call up a specific KB update and it has easy to read sections that list which KBs it supercedes, and which (if any) KBs supercede it.

Only problem was it came up empty on most of the test KBs I searched for. Of the 8 KBs listed in my reply #17, Update Catalog found only one.




Quote:

Running WSUS, is there a way to download a list of updates that are selected without actually downloading?

Not with WSUS Offline Update. It's scripted to run all by itself. It first downloads a master database file, wsusscn2.cab. This is evidently a master file cataloging all currently active KBs for all OS's and Office versions. I think WSUS Offline compares that list to your local cache (if you've previously downloaded updates) and then downloads and/or deletes files to/from the local cache to match the master catalog. When you run UpdateInstaller it again consults wsusscn2.cab and compares it to the system on which it's being run, and applies any missing updates without user intervention. Other than using a pre-emptive ExcludeList.txt, at no point does it stop to let you select/reject specific updates.

If you want that kind of control, you might want to take a look at Portable Update instead, an alternative to WSUS Offline. Personally, I have no interest in micro-managing the update process so I've been happy with WSUS Offline, but from screenshots Portable Update apparantly scans the target computer and pauses to show checkboxes of missing updates. That may be more up your alley.

@ Dan Goodell


Dan Goodell wrote on Oct 25^th, 2015 at 5:42am:

If you want that kind of control, you might want to take a look at Portable Update instead, an alternative to WSUS Offline. Personally, I have no interest in micro-managing the update process so I've been happy with WSUS Offline, but from screenshots Portable Update apparantly scans the target computer and pauses to show checkboxes of missing updates. That may be more up your alley.

Well, I still have all the updates in store, including the obsolete ones. I also have a list with these updates and hoped for a cross-reference. I mean, no need to download updates that I already have.

I'll have a look at Portable Update later.

Christer wrote on Oct 25^th, 2015 at 4:29pm:

Well, I still have all the updates in store, including the obsolete ones. I also have a list with these updates and hoped for a cross-reference. I mean, no need to download updates that I already have.

I'm not sure it would be as straightforward as copying your files to WSUS Offline's cache. For one thing, you'd have to figure out which directories to put them in. For another, I think the updates are in a different format. When I manually download an update from Microsoft Update I get a .msu file, but WSUS Offline downloads in .cab format.

@ Dan Goodell


Dan Goodell wrote on Oct 26^th, 2015 at 1:47pm:

When I manually download an update from Microsoft Update I get a .msu file, but WSUS Offline downloads in .cab format.

Now I'm confused, how do you know which updates to add to the ExcludeList if there is a cab-file only?

On my current system, it should not download and install anything, if it is possible to exclude optional updates by default, that is. It seems like I'll have to do some tests ... :-/ ... hit the button and run for cover.

You don't specify the filenames, you simply list the KB numbers. (See my ExcludeList in reply #9 for examples.) When you identify a particular update that you don't want WSUS Offline to install, open the ExcludeList.txt file and add its KB number.

I like to add the comma and a brief description so I can recall what the KB was about, but the description is optional.

Note that means the KB update will be excluded from all OSs, even though there might be different download filenames for the same KB pertaining to different OSs.

@ Dan Goodell

Okey, I understand, thanks for your patience!

Christer wrote on Oct 16^th, 2015 at 6:04am:

Since Microsoft started promoting the free upgrade to Windows 10, changes have occurred in Windows Update. I'm a true believer in not installing anything that I don't know that my system needs. This means that I have installed very few optional updates, only the "Platform Update for Windows 7" and other optional updates required to install Internet Explorer 11. This means that no updates pertaining to the "free Windows 10 upgrade" or the Windows Update Cient itself have been installed. As a side note, the updates to the Windows Update Cient are among the "critical/important" updates but they remove the Windows Update Icon from the Notification Area. Don't ask me why the Icon is removed but I like the Icon to be there so, I omit those updates too. I download the updates manually to the computer and install them off-line. Before installing the new batch of updates, I restore the Ghost Image from previous month and afterwards, I create a fresh Ghost Image. This means that the Windows Update Client is the same as when installed in 2011. There's no problem installing a batch of updates with a single reboot when done. However, during the month, when Windows Update checks for updates, strange things happen. My system has an AMD Phenom II, quadcore 3 GHz and 4 GB RAM. When the computer is started and Windows Update checks for updates, there's a process "TrustedInstaller" and an instance of svchost.exe that combined use 25% of the CPU and several GB of RAM. Total RAM usage is up to 75%. It goes on for some 25 minutes and when done, CPU usage drops to "idling" and RAM usage to 17-18%. If I try to manually install updates when this "process" is running in the background (not initiated by yours truly), I get to the first one but the second hangs until the "process" has been terminated. Well, I can terminate the "wsus process" and restart the computer between each update but what the heck ... :-X ... ? Prior to "Windows 10 promotion", a run of Windows Update took approximately a minute or a few at most. On a second startup, when Windows Update doesn't check for updates, the computer settles at 25% RAM usage with no excessive CPU usage. Is there anyone out there with the same experience? Any thoughts?

I quoted my first post to get back to the initial question. Since I didn't notice the "optional" updates to the Windows Update Client until they were made "important", I didn't read the documentation on the first or rather, second one.

The first one is KB2990214 (must have been imortant - if not, I wouldn't have it installed), released in April. Problems with it lead to the release of KB3050265 in June. Reading the KB-article for that one was interesting and I quote:


Quote:

You can configure this Group Policy object by using Group Policy (if the update is installed and if you use the updated WindowsUpdate.admx file by copying the file from where the editing policy is located). You can also do this by going to Computer Configuration > Policies > Administrative Templates > Windows Components > Windows Update, double-clicking Turn off the upgrade to the latest version of Windows through Windows Update, and then clicking Enabled. Policy path Computer Configuration / Administrative Templates / Windows Components / Windows Update Policy setting Turn off the upgrade to the latest version of Windows through Windows Update (enabled or disabled) To suppress this offer through the registry, set the following registry key: HKLM\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate DWORD: DisableOSUpgrade = 1

I created one reg-file to set it "ON" (1) and another to set it "OFF" (0).

I restored my most recent image (including KB2990214), installed KB3083710, the most recent update to the Windows Update Client (they replace eachother consecutively) but did NOT apply the regedit. Finally, I installed MSE and checked the behaviour when connecting to internet. It was slightly better than before. The time was the same (~25 minutes) and also the CPU-usage (~25%) but RAM-usage had dropped from ~75% to ~50%. I restarted the computer to verify that the WU-icon was missing from the Notification Area. These results are no news, I noted them already in post #6 but with slightly different "preconditions". No standing ovations and my hope was for the regedit.

I, again, restored the image and this time, I also applied the regedit. The result was approximately the same and I was disappointed until I restarted and found that ... :o ... the WU-icon was there. I can't find a single word in that KB-article about a missing icon that gets restored, can you?

I will let the system run with KB3083710 + the regedit for a while to find out the long term performance. One thing is certain, though: the "fix" will not be included in my next image ... 8-) ... !

Dan Goodell wrote on Oct 20^th, 2015 at 10:00pm:

I agree with NightOwl that Windows Update has become a disaster. For me it reached that point a few years ago, before the current GWX debacle. For about 3 years now, I've been turning Windows Update completely OFF on all the systems I support. I gave up on the "Let me choose" option when MS started sneaking certain updates by and auto-installing despite the "Let me choose" setting.

And now, as reported here and in numerous other places, Microsoft is making it harder to dodge Windows 10:

In early 2016 things will become more aggressive and Microsoft will again reclassify Windows 10 as a "Recommended" update. Given the default setting on Windows 7 and Windows 8 is for all Recommended updates to install automatically this means the vast majority of users will find the Windows 10 install process starts up on their machines.

The end result is a dramatic change of focus. While users will still be able to cancel the Windows 10 installation process, it means proactive effort will now be required to stop the upgrade as opposed to proactive agreement to start it.

Given Windows 10’s status will remain as a Recommended Update, however, it means even those who proactively stop it are likely to find the install process initiating every time new Recommended updates appear. The irritation value of this alone is likely to see many concede.

To reiterate what I stated earlier, I think it's now time we all turn off automatic updates as a matter of routine. Maybe we'll be left more exposed to hackers, but Microsoft has become a greater threat to our computers than hackers.

Dan Goodell wrote on Oct 31^st, 2015 at 3:31pm:

I gave up on the "Let me choose" option when MS started sneaking certain updates by and auto-installing despite the "Let me choose" setting.

Isn't that what antivirus solutions are supposed to prevent ... ::) ... malicious drive-by installations?

I'll probably stick to my monthly routine ...  8-) ... !

Christer wrote on Oct 24^th, 2015 at 4:58pm:

I've tried to go to Microsoft®Update Catalog but always draw a blank page.

I managed to get it working on Windows 7 SP1, starting Internet Explorer 11 from the programs menu by right-clicking and "run as administrator". Clicking the link initiated installation of an ActiveX Control. After that, I can start Microsoft Update Catalog the normal way and it works. My account is adminstrator but obviously not administrative enough to install the ActiveX control.

@ Christer, and @ Dan Goodell, and all

Just a general comment and rhetorical question:

with the current Windows Update status in total disarray, and everyone cherry picking which update(s) to install--and, seems like everyone is using a different set of criteria to decide which update to install--how can we have any idea what the current status of our own system is (are there unknown or unintended consequences if we have not applied a certain update--or series of updates) vs how that relates to someone else's system who may have applied or not applied other updates?

Just seems like total chaos!

(But, I guess that has always been an ongoing issue--we have a myriad number of different hardware configuations and installed software--who knows what's really going on!!!!!!)

@ Christer



Christer wrote on Oct 28^th, 2015 at 4:43pm:

I, again, restored the image and this time, I also applied the regedit. The result was approximately the same and I was disappointed until I restarted and found that ... Shocked ... the WU-icon was there. I can't find a single word in that KB-article about a missing icon that gets restored, can you?

Well, probably nothing mentioned in the KB article, but I mentioned that effect previously in this post of this thread:


NightOwl wrote on Oct 24^th, 2015 at 12:57am:

Apparently, either making a registry change to disable the *Get Windows 10* (GWX) from updating thru Windows Update, or using the *GWX Control Panel* to *Disable Operating System Upgrades in Windows Update*( http://blog.ultimateoutsider.com/2015/08/using-gwx-stopper-to-permanently-remove... ) allows for the *New Updates Available* icon returning if it has been missing.There are multiple reports that this is solving that problem in various comments at http://www.askwoody.com/

You have used the *registry change* to get the icon to come back.  Sure looks like if a system has the setting that allows Windows Update to upgrade the OS to the latest version, it is somehow preventing Windows Update from getting other updates (? must be looking for the OS upgrade exclusively?), and the icon never shows up because no updates are being obtained by Windows Update.  Changing that setting for the OS upgrade to disable that option releases Windows Update *from prison* so it can once again look for and find other updates!

I have not seen you comment on this information since Dan posted it:


Dan Goodell wrote on Oct 20^th, 2015 at 10:00pm:

For the benefit of lurkers, let's clarify that GWX and GWX Control Panel are two different things. GWX is Microsoft's "Get Windows 10" update, which MS tries to sneak in with other Windows updates into your 7 or 8.1 system. GWX Control Panel is a no-install, third-party utility to check and prevent MS from sneaking GWX into your system. GWX Control Panel is a vital tool to make sure your system is not being upgraded to Win 10 behind your back.

GWX Control Panel is now up to version 1.5.0.0.  You do not install anything--you just run the program from where ever you have downloaded it to.  Nothing happens or changes unless you explicitly tell the program to do it.

Read the details here so you know what to expect from the program:  http://blog.ultimateoutsider.com/2015/08/using-gwx-stopper-to-permanently-remove.html

Download it from here:  http://ultimateoutsider.com/downloads/

I would really recommend you download it, run it, and find out what, if anything, is present on your system that it finds, but you may not know about.  It could be part of your issue being as the GWX (Get Windows 10) is intimately associated with the Windows Update and the TrustedInstaller program.

I'd like to hear what you find!

I'm wondering if because you may have installed certain updates, but maybe not others--that's causing Windows Update to be thrashing around!?

(Now a teaser--I stumble upon another issue that may cause Windows Update and the TrustedInstaller to cause excessive CPU usage, and excessive read/writes to the hard drive--I'll save that for after hearing from you regarding this post--just to not have too many things going at once.)

NightOwl wrote on Nov 3^rd, 2015 at 3:23pm:

with the current Windows Update status in total disarray, and everyone cherry picking which update(s) to install--and, seems like everyone is using a different set of criteria to decide which update to install--how can we have any idea what the current status of our own system is (are there unknown or unintended consequences if we have not applied a certain update--or series of updates) vs how that relates to someone else's system who may have applied or not applied other updates?

I don't think you can ever know for sure. Even if you supposedly have the same updates as someone else, the systems may not be the same. For instance, if you installed updates A, B and C, and then D came along that superceded the first three, you may still have detritus from A, B and C leftover on your system. If I refrain from the first three and only install D, our two systems may appear identical (from a Windows Update perspective), but if your system has random BSODs that I don't get, how can we be sure that the detritus isn't the culprit?

That's part of why I settled on my annual "clean-install" procedure.

Beyond that, two systems that are not equally updated obviously face different risks. If you delay installing updates or cherry-pick which updates to install, you could be vulnerable to malware exploiting a particular security hole. OTOH, if you install every update the moment it comes out, you risk corruption of your system by faulty updates or are at the mercy of bad behavior by Microsoft, such as this GWX debacle or the inadvertant deauthorization of legitimate installations.

Neither approach is perfect, so pick the lesser of two evils. I've come to the conclusion Microsoft is the greater risk.

I used to delay installing updates by using the "Let me choose..." setting, then when selecting which updates to install I would unselect any update less than a month old. Microsoft has gotten so sloppy with vetting their updates in recent years that I figured it was better to let everyone else be the guinea pigs and I'd wait a month before installing any particular update. My theory was that if the update hadn't been pulled within a month, it was probably okay. And while I may theoretically be more vulnerable to malware during that intervening month, the risk seemed small.

As it's turned out, the risk has been nonexistant, so I began pushing that one month to three months, then six months. That dovetailed nicely into WSUS Offline, so I turned automatic updates off entirely. That strategy may not work for less cautious users, but it works very well for me.

(I might also mention that over the years I've seen many virus-laden systems from customers, but have noticed practically no correlation with whether or not their systems were up to date.)

In the past I've also gone through a period when I tried to micromanage updates by researching each one to see if it affected me, but that's really time-consuming and hard to do. Descriptions published by Microsoft aren't always clear enough to understand what they actually do and sometimes hide ulterior Microsoft motives. It was too much work trying to "opt-in" each update, so I now leave it to WSO's "opt-out" strategy (using an Exclude list). I'll accept every update WSO wants to install except for those I know I don't want because of flags raised in online chatter.

I also accept only "Important" (nee, "Critical") updates, and never "Optional" updates. That's also WSO's strategy, so it works well for me.

Optional updates have been a "never install" for many years. Optional updates include hardware updates, and in all my years working on other people's systems I've seen far too many disasters caused by Microsoft overriding the OEM's drivers. I have never, ever found an Optional update I actually needed.

@ NightOwl


NightOwl wrote on Nov 3^rd, 2015 at 4:07pm:

Well, probably nothing mentioned in the KB article, but I mentioned that effect previously in this post of this thread:

Yes, you did but I have nothing installed pertaining to GWX so why would the WU-Icon be gone on my system? I only tested different versions of the update to the "Windows Update Client".


NightOwl wrote on Nov 3^rd, 2015 at 4:07pm:

You have used the *registry change* to get the icon to come back.Sure looks like if a system has the setting that allows Windows Update to upgrade the OS to the latest version, it is somehow preventing Windows Update from getting other updates (? must be looking for the OS upgrade exclusively?), and the icon never shows up because no updates are being obtained by Windows Update. Changing that setting for the OS upgrade to disable that option releases Windows Update *from prison* so it can once again look for and find other updates!

As I mentioned, I have no such setting, unless it comes with the updates to the "Windows Update Client". If you initiate Windows Update via Start > All programs or via the Control Panel, new updates are there (I know because there are updates that I don't install but have not hidden). WU finds the updates but the notification in the Notification Area doesn't work.


NightOwl wrote on Nov 3^rd, 2015 at 4:07pm:

I would really recommend you download it, run it, and find out what, if anything, is present on your system that it finds, but you may not know about.  It could be part of your issue being as the GWX (Get Windows 10) is intimately associated with the Windows Update and the TrustedInstaller program. I'd like to hear what you find! I'm wondering if because you may have installed certain updates, but maybe not others--that's causing Windows Update to be thrashing around!?

I'll do that and come back with the results. Initially, since not having anything pertaining to GWX installed, I thought that there was no point running it. We'll see ... :-/ ... !


NightOwl wrote on Nov 3^rd, 2015 at 4:07pm:

(Now a teaser--I stumble upon another issue that may cause Windows Update and the TrustedInstaller to cause excessive CPU usage, and excessive read/writes to the hard drive--I'll save that for after hearing from you regarding this post--just to not have too many things going at once.)

I too have a teaser - KB3102810 that was released yesterday among the optional updates. I have installed it but also made other changes that render the result inconclusive. I'll be back!

@ Dan Goodell


Dan Goodell wrote on Nov 3^rd, 2015 at 4:50pm:

I have never, ever found an Optional update I actually needed.

I have installed a few prerequisite updates to be able to install IE11, among them the Platform update for Windows 7 SP1 and Windows Server 2008 R2 SP1. Have you denied this and the other prerequisite updates too?

Do you run a different browser and not Internet Explorer at all?

In my response to NightOwl, I mentioned KB3102810 and changes that I have made. Those changes pertain to some prerequisite updates for IE11 but as I wrote, I'll be back.

@ NightOwl


Christer wrote on Nov 4^th, 2015 at 5:07am:

I'll do that and come back with the results. Initially, since not having anything pertaining to GWX installed, I thought that there was no point running it. We'll see ... :-/ ... !

I ran it and it found nothing. WU OS upgrades were not enabled, set by the regedit "Windows7-DisableOSUpgrade-ON" (1). After running the regedit "Windows7-DisableOSUpgrade-OFF" (0), WU OS upgrades were enabled. It seems like GWX Control Panel works and my system appears to be clean.

Christer wrote on Nov 4^th, 2015 at 5:21am:

In my response to NightOwl, I mentioned KB3102810 and changes that I have made. Those changes pertain to some prerequisite updates for IE11 but as I wrote, I'll be back.

I have not yet repeated any changes but started by restoring an Image from October. It has all prerequisites and IE11 installed. I found out what the installer expects by letting it do the installation on-line and download what is needed. I found these new entries in the update history:

KB2670838
KB2729094
KB2834140
KB2882822

With reference to Prerequisite updates for Internet Explorer 11, a few listed in it are obviously not necessary. Trying to install them, just to test, I got the message "can not be installed on this system" or whatever it says in English (my computer speaks Swedish) for KB2731771 and KB2533623 but KB2786081 had already been installed.

When these prerequisite updates had been installed by the IE11 installer, I let Windows Update loose. It prompted for the installation of these updates:

KB2912390 (new)
KB3035126 (reinstallation)
KB3035132 (reinstallation)
KB3078601 (reinstallation)

I suspect that reinstallation of these 3 updates was caused by installing the "platform update".

(This on-line installation of IE11 was just a test to find the prerequisite updates. It was undone by restoring an Image and all subsequent installations have been off-line.)

Now, after restoring the Image from October, I installed KB3083710 with a reboot and finally MSE prior to connecting to the internet.

MSE got updated and ran its first Quick-scan (~11 minutes) and Windows Update did its thing. It completed in ~28 minutes hovering around 25% CPU-usage and 45% RAM-usage (total) which dropped to 0% and 35% respectively when activities ceased. There was no WU-icon in the Notification Area.

Next, I added the regedit "Windows7-DisableOSUpgrade-ON" and restarted the computer.

This second run of Windows Update took ~10 minutes with the same CPU-/RAM-usage. When it had completed, the WU-icon showed up in the NA.

Finally, I added KB3102810, yesterday's addition to the mess, restarted and let it all loose again.

The WU-icon appeared after 2 minutes and Windows Update never ran, I think - there was no TrustedInstaller appearing in TaskManager but there was CPU- and RAM-usage for ~10 minutes.

I checked the version of the Windows Update Client. It had been updated from 7.6.7601.19016 (KB3083710) to 7.6.7601.19046 (KB3102810). The latter is not said to replace the former as has been the case with the other consecutive updates to the Windows Update Client. The latter is not labeled as important but optional. Maybe I've asked this before ... :-X ... what the heck are the guys in Redmond smoking?

As soon as I can find the time, I'll take the IE11 installation to "square one". The reason is that KB2882822 is labeled as optional and has a "foul scent" of "you know what" which I'd like to avoid. More later ... :-? ... how much later, I can't say.

Christer wrote on Nov 4^th, 2015 at 5:21am:

I have installed a few prerequisite updates to be able to install IE11, among them the Platform update for Windows 7 SP1 and Windows Server 2008 R2 SP1. Have you denied this and the other prerequisite updates too? Do you run a different browser and not Internet Explorer at all?

I'm not sure what you mean by "denied". If you mean do I add KBs of optional (aka, "Recommended") updates to WSO's Exclude list, the answer is no. I only add to the Exclude list KBs that are on my radar. I don't think optional KBs would come to my attention.

If you mean do I deny them because they are optional ... well, yeah. When using Windows Update I have always unticked the option, "Give me recommended updates the same way I receive important updates". Thus, Windows Update did not notify me of optional updates, and I never installed any of them. Now that I use WSO in lieu of Windows Update, I still don't get optional updates because WSO only downloads Important updates.

Also, I'm not clear how a prerequisite could be optional. If it's optional if you do not upgrade IE, then no, my technique will not install it. If it's required if you do upgrade IE, then it isn't optional, right? In that case, it would have to be bundled as part of the IE upgrade installer, just in case the system being upgraded didn't have the prerequisites already installed. If I upgrade IE then I would indeed get the otherwise "optional" update, as well--but not because I explicitly accepted an optional update.

WSO gives you the option of whether or not to upgrade your IE version. Of course WSO will update to your installed version of IE if they are classified as Important updates, but it will not upgrade from one version to another without your permission.

I do not use IE because of its security issues, but of course it's on my system whether I use it or not.

@ Dan Goodell

Okey, we are "rowing different boats", I use Windows Update while you use WSO and that's contributing to the confusion.


Dan Goodell wrote on Nov 4^th, 2015 at 2:54pm:

I'm not sure what you mean by "denied".

I thought that you had been made aware of the "platform update" but chosen to not install it.


Dan Goodell wrote on Nov 4^th, 2015 at 2:54pm:

When using Windows Update I have always unticked the option, "Give me recommended updates the same way I receive important updates". Thus, Windows Update did not notify me of optional updates, and I never installed any of them.

That's my decision too whith the exception that "I never" is not entirely true.

The fact that the "platform update", being rather significant, is optional and not important is surprising to me. You, like I, never even look at the optional updates but installing IE11 made me aware of this update and other optional updates that were made important or maybe ... ;D ... "optional but mandatory" by installing IE11.


Dan Goodell wrote on Nov 4^th, 2015 at 2:54pm:

In that case, it would have to be bundled as part of the IE upgrade installer, just in case the system being upgraded didn't have the prerequisites already installed.

That's exactly what happens. The prerequisite updates aren't bundled within the setup file but during setup, the installer analyses the system and downloads what is missing. That's how I found out what is needed but it seems like some of the updates the installer deem to be necessary, really aren't. If you choose to install IE11 off-line, you have to download and install the prerequisite updates manually. I will get back to this subject and what pussles me is that the installer downloads and installs KB2882822 even though that update has been replaced by KB3080149 (which is in your ExcludeList).

I quote from KB3080149:


Quote:

Update replacement information This update doesn't replace a previously released update.

Well, according to Microsoft Update Catalog it does replace seven updates!

More on "what is really prerequisites for IE11" later.

Christer wrote on Nov 4^th, 2015 at 1:33pm:

As soon as I can find the time, I'll take the IE11 installation to "square one". The reason is that KB2882822 is labeled as optional and has a "foul scent" of "you know what" which I'd like to avoid. More later ... :-? ... how much later, I can't say.

With reference to reply #35, I have done a few tests to find out which updates really are prerequisites. If running off-line, the IE11 installer will not proceed if any of KB2670838, KB2729094 or KB2834140 have not been installed.

The installation of IE11 continues without KB2882822 on the system but upon completion, a popup tells that a "word list" or "language pack" (I can't remember which) is missing and WU must be run. When closing the installer window, WU gets launched but since the computer is off-line, nothing happens. Later, when running WU, there's no "word list" or "language pack" on offer.

A result of installing KB2670838, the "platform update", is that after running WU, KB2912390 (new) appears and KB3035126, KB3035132, KB3078601 have to be reinstalled.

In addition, the most recent cumulative update to IE has to be installed in the correct version (IE11) and also any of those updates to the Windows Update Client.

I will restore some images I created and check C:\Windows\IE11_main.log in each of them to, if possible find something out.

FWIW, I restored a fresh, unupdated Win7 SP1 install, and unleashed WSO on it. I did not tell WSO to update IE8. The updates mentioned in Reply #38 were not installed. (FTR, those KBs are actually in WSO's cache, but they were not installed.)

Repeating the test and ticking the WSO option to install IE11 resulted in WSO installing 7 additional updates: 2639308, 2670838, 2729094, 2786081, 2834140, 2882822, 2888049. These seem to be the prerequisites Christer was mentioning. WSO identified that they were no longer optional and added them.

(Christer may have had fewer updates because I went straight from IE8 to IE11.)

Bottom line is that if those updates are optional without IE11, WSO will not install them. If they're required for IE11, then of course they aren't optional and WSO will install them.

BTW, none of the updates in my WSO Exclude list were installed, even though they had been downloaded and do exist in the WSO cache.

That's just the way I've always understood WSO to work. It installs "Important" updates but I can opt out of specific updates. No "Recommended" updates are installed, and just like WU it's able to determine which are important by analyzing your specific Windows installation.

That's exactly what I want from an offline installer.

Dan Goodell wrote on Nov 7^th, 2015 at 2:55am:

Repeating the test and ticking the WSO option to install IE11 resulted in WSO installing 7 additional updates: 2639308, 2670838, 2729094, 2786081, 2834140, 2882822, 2888049. These seem to be the prerequisites Christer was mentioning. WSO identified that they were no longer optional and added them.

Those updates are the same that are found in Prerequisite updates for Internet Explorer 11 with the exception of KB2533623 and KB2731771 which "can not be applied" (or words to that meaning in a message during an attempt to install manually) on my system and seemingly neither on your system. 6 are "labeled" as prerequisites (of which 2 can not be applied) and 3 are "labeled" as optional.

I have checked the logfiles created during installation attempts of IE11. I quote from the logfile with no prerequisites installed at all:


Quote:

00:20.234: INFO:    Version Check for (KB2834140) of C:\Windows\System32\d3d11.dll: 6.1.7601.17514 >= 6.2.9200.16570 (False) 00:20.249: WARNING: Checking version for C:\Windows\System32\api-ms-win-downlevel-user32-l1-1-0.dll.  The file does not exist. 00:20.265: INFO:    Version Check for (KB2639308) of C:\Windows\System32\Ntoskrnl.exe: 6.1.7601.19018 >= 6.1.7601.17727 (True) 00:20.312: INFO:    Version Check for (KB2533623) of C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll: 6.1.7601.19018 >= 6.1.7601.17617 (True) 00:20.358: INFO:    Version Check for (KB2731771) of C:\Windows\System32\conhost.exe: 6.1.7601.19018 >= 6.1.7601.17888 (True) 00:20.390: INFO:    Checking for correct version of C:\Windows\Fonts\segoeui.ttf. 00:20.405: INFO:    Version Check for (KB2786081) of C:\Windows\System32\taskhost.exe: 6.1.7601.18010 >= 6.1.7601.18010 (True) 00:20.530: INFO:    Version Check for (KB2888049) of C:\Windows\System32\drivers\tcpip.sys: 6.1.7601.18438 >= 6.1.7601.18254 (True) 00:20.577: INFO:    Version Check for (KB2882822) of C:\Windows\System32\tdh.dll: 6.1.7600.16385 >= 6.1.7601.18247 (False) 00:51.434: INFO:    Download for KB2834140 initiated. Downloading http://go.microsoft.com/fwlink/?LinkID=303935 -> KB2834140_amd64.MSU. 00:51.481: INFO:    Download for KB2670838 initiated. Downloading http://go.microsoft.com/fwlink/?LinkID=272391 -> KB2670838_amd64.CAB. 00:51.512: INFO:    Download for KB2729094 initiated. Downloading http://go.microsoft.com/fwlink/?LinkID=258385 -> KB2729094_amd64.MSU. 00:51.543: INFO:    Download for KB2882822 initiated. Downloading http://go.microsoft.com/fwlink/?LinkID=324541 -> KB2882822_amd64.MSU. 00:51.574: INFO:    Waiting for 4 prerequisite downloads. 01:06.660: INFO:    Prerequisite download processes have completed. Starting Installation of 4 prerequisites. 01:06.691: ERROR:   Error downloading prerequisite file (KB2834140): 0x800c0005 (2148270085) 01:06.753: INFO:    PauseOrResumeAUThread: Successfully resumed Automatic Updates. 01:20.793: INFO:    Setup exit code: 0x00009C47 (40007) - Required updates failed to download.

00:20.234 - not installed, not replaced > "false"

00:20.249 - has to be about the platform update, KB2670838 - not installed > file does not exist

Next, there are three checks which come out as "true". All those updates have each been replaced by several updates, of which at least one is installed on my system

00:20.390 - has to be about KB2729094 which seemingly comes out as "false" since I have to install it for IE11 to install

00:20.405 - comes out as "true" and is installed on my system

00:20.530 - comes out as "true" but is neither installed on my system nor has it been replaced by another update. Some other update must have installed the checked file in the correct version.

00:20.577 - comes out as "false", is not installed. It has been replaced by another update but neither that one is installed.

01:06.691 - the installation fails on KB2834140, probably the first update attempted.

So, Dan is correct in his assumption that we have different startingpoints but:


Dan Goodell wrote on Nov 7^th, 2015 at 2:55am:

(Christer may have had fewer updates because I went straight from IE8 to IE11.)

In my images, I have not updated IE8. It takes only a few minutes to do and I am glad that, when istalling IE11, there are no remnants of IE9 and IE10.

I also checked the logfile with all prerequisite updates installed with the exception of KB2882822:


Quote:

00:20.888: INFO:    Version Check for (KB2882822) of C:\Windows\System32\tdh.dll: 6.1.7600.16385 >= 6.1.7601.18247 (False) 00:52.697: INFO:    Download for KB2882822 initiated. Downloading http://go.microsoft.com/fwlink/?LinkID=324541 -> KB2882822_amd64.MSU. 00:52.728: INFO:    Waiting for 1 prerequisite downloads. 01:07.813: INFO:    Prerequisite download processes have completed. Starting Installation of 1 prerequisites. 01:07.829: WARNING: Error downloading non-blocking prerequisite file (KB2882822): 0x800c0005 (2148270085)

01:07.829 reveals that there are "non-blocking" prerequisite files and I assume that is the same when it comes to, KB2639308 and KB2888049 which also are "optional" (according to "Prerequisite updates for Internet Explorer 11").

I have forgotten to mention that prior to connecting to the internet (freshly restored Image) and running Windows Update, I can manually install several updates with only a single reboot. After connecting to the internet and running Windows Update, no more.

After installing the first update, the next hangs on "checking the system for updates" while churning on at high CPU- and RAM-usage. If I wait long enough, several minutes, it continues. If I reboot, I have a minute or two to do the next installation, prior to TrustedInstaller (possibly initiated the manual installation of an update) starting the show again.

However, turning automatic updates off seems to be a workaround but no matter what, my previous question about "what they are smoking" is still valid. Windows Update is a total disaster!

I noted that KB3102810, which was released as optional a week or two ago, was re-released this Tuesday as important. The KB-article had not been updated to show this but it was offered to my system as important. It was/is also said to not replace any previous updates but the October version of the update to the Windows Update Client, KB3083710, is no longer offered. I don't know if the regedit works with only KB3102810 installed but I have no time to check until monday at the earliest.

After this week's  batch of updates, I made a trial installation of IE11 and noted that some of the versions of the files, not updated as prerequisites and checked by the installer, had changed:


Quote:

Before installing this week's updates: 00:20.265: INFO:    Version Check for (KB2639308) of C:\Windows\System32\Ntoskrnl.exe: 6.1.7601.19018 >= 6.1.7601.17727 (True) 00:20.312: INFO:    Version Check for (KB2533623) of C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll: 6.1.7601.19018 >= 6.1.7601.17617 (True) 00:20.358: INFO:    Version Check for (KB2731771) of C:\Windows\System32\conhost.exe: 6.1.7601.19018 >= 6.1.7601.17888 (True) After installing this week's updates: 00:20.233: INFO:    Version Check for (KB2639308) of C:\Windows\System32\Ntoskrnl.exe: 6.1.7601.19045 >= 6.1.7601.17727 (True) 00:20.280: INFO:    Version Check for (KB2533623) of C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll: 6.1.7601.19045 >= 6.1.7601.17617 (True) 00:20.326: INFO:    Version Check for (KB2731771) of C:\Windows\System32\conhost.exe: 6.1.7601.19045 >= 6.1.7601.17888 (True)

It has been noted earlier that every system is different, depending on which updates have been installed and this is a bit of evidence.

I'll be away from home until Monday next week and will probably not be able to respond to any comments you may post. Have a nice weekend, all!

Christer wrote on Nov 12^th, 2015 at 1:36am:

I noted that KB3102810, which was released as optional a week or two ago, was re-released this Tuesday as important. The KB-article had not been updated to show this but it was offered to my system as important. It was/is also said to not replace any previous updates but the October version of the update to the Windows Update Client, KB3083710, is no longer offered. I don't know if the regedit works with only KB3102810 installed but I have no time to check until monday at the earliest.

My statement that "the October version of the update to the Windows Update Client, KB3083710, is no longer offered" refers to my system after an Image restore to prior to installing any update at all, pertaining to "the Windows Update Client".

KB3102810 does replace all earlier updates to the Windows Update Client, well, at least according to the information at Microsoft Update Catalog.

KB3102810 removes the WU-icon from the Notification Area but the regedit brings it back.

When I started the computer today, I timed the activities at startup:

13:00 - up and running - CPU = 0% - RAM = 30%
13:02 - WU-icon appears in the Notification Area and TrustedInstaller appears in the TaskManager - variations in CPU- and RAM-usage but it "stabilizes" at
13:04 - CPU = 25% - RAM = 50%
13:11 - CPU = 0% - RAM = 50% - this is the timestamp for WU checking for updates
13:12 - CPU = 25% - RAM = 50%
13:20 - CPU = 0% - RAM = 50% - this is the timestamp for MSE checking for updates/definitions
13:21 - CPU = 25% - RAM = 50%
13:29 - CPU = 0% - RAM = 50%
13:31 - TrustedInstaller disappears from the TaskManager - CPU = 0% - RAM = 50%
13:34 - CPU = 0% - RAM = 25%

The question is if the timestamp in the WU-application and the MSE-application is the start or the finish of the search? (I believe it is the finish.)

The difference in "stabilized" RAM-usage (50% - 25% = 25%) is 1 GB on my system. That's better (lower) than with other updates to the Windows Update Client installed when it was double that number.

Why does it have to take ½ an hour when it took a few minutes before this degradation of Windows Update?

What is it (actually) doing ... >:( ... ?

@ Christer

Until Win10 I had Windows Updates set to Never Update. I updated manually about 3 weeks after the updates were released. Now with Win10  you have no control over the updates so I just sit back and let them happen. Win10 is great. It feels faster than Win8 which felt faster than Win7.

@ Brian
Thanks for your input! I think that I've read somewhere that there's a difference between different versions of W10 regarding "control over Windows Update" but that's another thread ... :-/ ... because I have a feeling that this one has gone on for too long and people are losing interest.

Off-Topic replies have been moved to this Topic.

@ Christer


Christer wrote on Nov 19^th, 2015 at 2:27am:

I have a feeling that this one has gone on for too long and people are losing interest

Actually, I have not lost interest--I am just a poor responder these days  :-[  !

So, I wanted to come back to this statement and complete the thought:


NightOwl wrote on Nov 3^rd, 2015 at 4:07pm:

Now a teaser--I stumble upon another issue that may cause Windows Update and the TrustedInstaller to cause excessive CPU usage, and excessive read/writes to the hard drive

Here's the story:

I had a friend call and say they were getting a warning that they were running out of disk space on their OS partition.

I stopped by and looked at the system and found that there was only about 800 MB of unused space left on their Win7 OS partition. 

To look closer at the where all the used space was, I used this product called SpaceSniffer:

http://www.uderzo.it/main_products/space_sniffer/index.html

You don't have to install anything--it runs as a stand alone program--just extract it and it will run from wherever you put the .exe program--I have it on my USB thumb drive.  It shows the entire drive using boxes of different sizes for different directories, sub-directories, and files.  The box size is relative to the amount of space that is being used by the particular item.

(Another good program that does the same is WinDirStat--the standard program is installed on your system:  https://windirstat.info/ .  Or, you can use the portable app version:  http://portableapps.com/apps/utilities/windirstat_portable ,   which can be installed on a USB thumb drive also and run from there--that's actually the one I use.)

Well, I found a big unexpected directory of almost 9 GBs:  c:\windows\logs\cbs\  .  I did'nt have time to look closely at what the *cbs* directory was at the time, until I got home--but the OS partition was about 60 GB total and it was almost all used up!

Once at home I found these references:

https://social.technet.microsoft.com/Forums/windowsserver/en-US/3b0b2bbc-d295-4a1b-8818-0b76ebe36b5a/cbslog-file-huge

http://felixyon.blogspot.com/2013/03/mysterious-cab-files-fill-up-temp-folder.html

http://superuser.com/questions/803842/why-is-cbs-log-file-size-20-gb

https://community.shavlik.com/thread/448019

These references talk about this problem (i.e. running out of disk space on the OS partition) being related to Windows Update, TrustedInstaller.exe (Windows Module Installer), and I think about installing updates take a longer time to happen.  I initially thought they also talked about high CPU and RAM usage--but, that may have been a reference that I did not bookmark, because I did not see that in the above links when I reviewed them.

And, I had noted that you had said this earlier:


Christer wrote on Oct 21^st, 2015 at 6:54am:

Space is, however, becoming a problem since the W7 installation has grown from 13313 MB (january 2011) to 32404 MB (october 2015)...     I have not installed any programs of significant size and that 143% growth ...is, more or less, caused by updates to Windows and Office!

So, I initially thought this problem with the *CBS* directory and its files growing beyond about 0.5 to possibly 1.5 GB at most might relate to your problem(s).  But, now that I can't find any reference to excess RAM and CPU usage--I'm betting that the problem is unrelated to what you have been talking about.

But, you might want to check out the *CBS* directory to see how large it is!  I checked mine and it was only about 700 MB.

Regarding checking directory and file sizes on my friends computer--what I found was that there are two very large directories  c:\window\winsxs (I now call that the *windows sucks* directory) which was about 12 GBs and a second one c:\windows\installer  which was about 5 GBs.  I saw your comment here:


Christer wrote on Oct 21^st, 2015 at 6:54am:

I'm aware of the Disk Cleanup Wizard addon, I have tested it but didn't install it "permanently". After running it, there was a significant reduction of used space, at the time some 5 GB. Do you have that update installed and if so, do you use it?

I ran the Disk Cleanup Wizard on my friend's system and it reduced the winsxs directory by about 2 GBs and the installer directory by about 1 GB.

I searched to see if there was any other way to reduce the size of those two directories, or possibly move them to another partition to free up space on the OS partition--but, all the advice I came across said not to mess with them!  Also tried to find if I could move the *hibernation* file (my friend likes to use that feature), but apparently that is not allowed either--dang it!

I have more comments that I want to make regarding other items in this thread (and maybe this post as well), but it will have to wait for a day or 2 or 3.....!

@ NightOwl


NightOwl wrote on Dec 2^nd, 2015 at 1:11am:

Actually, I have not lost interest--I am just a poor responder these days!

That comment was not directed at you but in general. Threads should not go on "for ever".


NightOwl wrote on Dec 2^nd, 2015 at 1:11am:

I used this product called SpaceSniffer ... Another good program that does the same is WinDirStat

I'll download and have a look at those later.


NightOwl wrote on Dec 2^nd, 2015 at 1:11am:

But, you might want to check out the *CBS* directory to see how large it is!I checked mine and it was only about 700 MB.

With my monthly restore of the previous Image, whatever my system accumulates is not very long lived. At present, my CBS folder holds 6 files, 44 MB.


NightOwl wrote on Dec 2^nd, 2015 at 1:11am:

Regarding checking directory and file sizes on my friends computer--what I found was that there are two very large directories c:\window\winsxs (I now call that the *windows sucks* directory) which was about 12 GBs and a second one c:\windows\installer which was about 5 GBs.

On my system, c:\window\winsxs holds 88003 files in 22449 folders > 21,1 GB and yes, it sucks because it holds every single update that has been installed in store, should the user wish to uninstall any of them. That's why Disk Cleanup Wizard can reduce its size by removing obsolete entries. On my system, c:\windows\installer holds 1148 files in 146 folders > 4,67 GB.

I'll run Disk Cleanup Wizard later to see what difference it makes.

Off topic but this works with Win8 onward....

Dism.exe /online /Cleanup-Image /StartComponentCleanup /ResetBase

http://www.techsupportalert.com/content/how-check-size-and-reclaim-disk-space-winsxs-windows-81.htm

I've been using it for two years. No issues and it certainly reduces C: drive used space.

My OS is 3 years old, Win8 upgraded to Win10. WinSxS folder is 6 GB, Installer folder is 3 GB.

@ Christer


Christer wrote on Dec 2^nd, 2015 at 12:43pm:

That comment was not directed at you but in general.

I did not take any personal offense--was just saying that *I* was not done yet--even if no one else was commenting!


Christer wrote on Dec 2^nd, 2015 at 12:43pm:

I'll download and have a look at those later.

You can take a look at the directory size before and after using the Disk Cleanup Wizard with the SpaceSniffer or Windirstat program to see how effective the process was.


Christer wrote on Dec 2^nd, 2015 at 12:43pm:

That's why Disk Cleanup Wizard can reduce its size by removing obsolete entries.

Yup!

Just a FYI for anyone viewing this, you have to select the *Clean up System Files* on the initial *Disk Cleanup* tab if you want to get the *Windows Update Cleanup* option--which is for the *winsxs* and *installer* directories--see here for screen shots:  http://blogs.technet.com/b/askpfeplat/archive/2013/10/08/breaking-news-reduce-the-size-of-the-winsxs-directory-and-free-up-disk-space-with-a-new-update-for-windows-7-sp1-clients.aspx

@ NightOwl


NightOwl wrote on Dec 2^nd, 2015 at 5:33pm:

You can take a look at the directory size before and after using the Disk Cleanup Wizard with the SpaceSniffer or Windirstat program to see how effective the process was.

I downloaded SpaceSniffer (SS) and compared to Windows Explorer, size according to the properties of the folders. Both reported the same sizes but SS sorted in order of size. The CBS-folder was so small that I had to search specifically for it.

Sizes below are before and after running Disk Cleanup Wizard (DCW):

c:\window\installer - before = 4,67 GB - after = 4,67 GB - no difference

c:\windows\logs\cbs - before = 75,7 MB - after = 735 MB - :-? - a lot to log, obviously

c:\windows\winsxs - before = 21,2 GB - after = 11,5 GB - reduction 9,7 GB

Prior to running DCW, it reported that 9,46 GB would be cleared.